#!/bin/sh
#
# Author: 	T.J.
# Date:		5/21/07
# Modified:	5/21/07
# Name:		Iptables Setup
#

# Flush iptables
iptables -X
iptables -F -t filter
iptables -F -t nat
iptables -F -t mangle
iptables -Z

# Policy: Drop All
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# LOCAL TRAFFIC

# Allow loopback traffic
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# EXTERNAL TRAFFIC

# Allow interfaces to receive traffic
iptables -A INPUT -i eth0 -j ACCEPT
iptables -A OUTPUT -o eth0 -j ACCEPT
iptables -A INPUT -i eth1 -j ACCEPT
iptables -A OUTPUT -o eth1 -j ACCEPT 

# ROUTING

# Main Routing
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Enable Forward
iptables -A FORWARD -m state -i eth1 -o eth0 --state NEW,RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -m state -i ppp0 -o eth1 --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -m state -i eth1 -o ppp0 --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT
iptables -A FORWARD -i eth0 -o ppp0 -j ACCEPT
iptables -A FORWARD -i eth1 -o ppp0 -j ACCEPT
iptables -A FORWARD -i ppp0 -o eth1 -j ACCEPT
iptables -A FORWARD -i ppp0 -o eth0 -j ACCEPT

# Port Forwarding

# OLD

# VMWare
#iptables -t nat -A PREROUTING -p tcp --dport 902 -i eth1 -j DNAT --to 10.0.0.11:902
#iptables -t nat -A POSTROUTING -p tcp -o eth0 -j SNAT --to 10.0.0.11:902
#iptables -A FORWARD -p tcp -i eth1 -d 10.0.0.11 --dport 902 -j ACCEPT

# Apache
#iptables -t nat -A PREROUTING -p tcp --dport 10101 -i eth1 -j DNAT --to 10.0.0.100:10101
#iptables -t nat -A POSTROUTING -p tcp -o eth0 -j SNAT --to 10.0.0.100:10101
#iptables -A FORWARD -p tcp -i eth1 -d 10.0.0.100 --dport 10101 -j ACCEPT

# Post-routing
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

# FIREWALL

# Drop malicious TCP packets that have errornous headers
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
iptables -A OUTPUT -p tcp --tcp-flags ALL ALL -j DROP

# Drop malformed packets with NULL headers
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
iptables -A OUTPUT -p tcp --tcp-flags ALL NONE -j DROP

# Drop stealth scans
#iptables -A INPUT -i eth1 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE
#iptables -A INPUT -i eth1 -p tcp -m tcp --tcp-flags SYN,FIN SYN,FIN
#iptables -A INPUT -i eth1 -p tcp -m tcp --tcp-flags SYN,RST SYN,RST
#iptables -A INPUT -i eth1 -p tcp -m tcp --tcp-flags FIN,RST FIN,RST
#iptables -A INPUT -i eth1 -p tcp -m tcp --tcp-flags ACK,URG URG

# Allow ICMP ECHO-REQUEST
iptables -t filter -A INPUT -i eth0 -p icmp --icmp-type ! echo-request -j ACCEPT
iptables -t filter -A INPUT -i eth1 -p icmp --icmp-type ! echo-request -j ACCEPT

# Allow Arbitrary Ports - COMMENTED
#iptables -A INPUT -p tcp --dport 1025:65535 -j ACCEPT
#iptables -A OUTPUT -p tcp --dport 1025:65535 -j ACCEPT

# Enable SSH
iptables -A INPUT -p tcp --syn --dport 22 -j LOG --log-prefix "SSH SYN "
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
#iptables -A INPUT -s 0/0 -p tcp -m tcp --dport 22 -j ACCEPT

# Enable 67/68
iptables -A INPUT -i eth1 -s 0/0 -p tcp -m tcp --dport 67:68 -j ACCEPT

# Enable ident
iptables -A INPUT -i eth1 -s 0/0 -p tcp -m tcp --dport 113 -j ACCEPT

# Enable Webmin
iptables -A INPUT -i eth0 -p tcp -m tcp --dport 3180 -j ACCEPT

# Enable 4040:4041
iptables -A INPUT -i eth1 -s 0/0 -p tcp -m tcp --dport 4040:4041 -j ACCEPT

# Enable IRC
iptables -A INPUT -i eth1 -s 0/0 -p tcp -m tcp --dport 6660:6669 -j ACCEPT

# Enable Apache
iptables -A INPUT -i eth1 -s 0/0 -p tcp -m tcp --dport 10101 -j ACCEPT

# Enable VMWare Console
#iptables -A INPUT -i eth1 -s 0/0 -p tcp -m tcp --dport 65500 -j ACCEPT

# Enable 65505
iptables -A INPUT -i eth1 -s 0/0 -p tcp -m tcp --dport 65505 -j ACCEPT

# Enable 65516
iptables -A INPUT -i eth1 -s 0/0 -p tcp -m tcp --dport 65516 -j ACCEPT

# Enable 65534:65535
iptables -A INPUT -i eth1 -s 0/0 -p tcp -m tcp --dport 65534:65535 -j ACCEPT
# 65535 Highest Port Available

# VMWare
iptables -t nat -A PREROUTING -p tcp --dport 902 -i eth1 -j DNAT --to 10.0.0.11:902
iptables -t nat -A POSTROUTING -p tcp -o eth0 -j SNAT --to 10.0.0.11:902
iptables -A FORWARD -p tcp -i eth1 -d 10.0.0.11 --dport 902 -j ACCEPT

# Apache
iptables -t nat -A PREROUTING -p tcp --dport 10101 -i eth1 -j DNAT --to 10.0.0.100:10101
iptables -t nat -A POSTROUTING -p tcp -o eth0 -j SNAT --to 10.0.0.100:10101
iptables -A FORWARD -p tcp -i eth1 -d 10.0.0.100 --dport 10101 -j ACCEPT

# SAVE
iptables-save > iptables.save